Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
What Business Email Compromise Is and How It Operates
Never verify bank detail changes through the contact information provided in an email or attached invoice. Always look up the recipient using a verified phone number stored in your primary accounting database.
Business email compromise is a form of cybercrime where an attacker uses email fraud to deceive an organization into sending money or sensitive corporate records. Unlike conventional attacks that deliver malicious software payloads, these intrusions rely heavily on social engineering and impersonation. The attacker targets employees who hold the authority to approve financial transactions, such as controllers, accounts payable specialists, and business executives. By inserting themselves into existing business workflows, attackers redirect routine payments into accounts under their direct control.
The operation usually starts weeks before any fraudulent invoice appears. The attacker conducts reconnaissance against the target organization to map executive hierarchies, identify key vendors, and observe invoicing cycles. They often harvest employee credentials through deceptive login portals or exploit accounts that lack secondary login protections. Once inside an email account, the intruder studies active conversations, payment schedules, and communication styles to craft messages that appear legitimate to coworkers and external partners.
According to CISA phishing guidance, attackers frequently manipulate emotional triggers such as urgency or confidentiality to bypass normal verification steps. When an urgent email arrives seemingly from a chief executive requesting an emergency wire transfer for an acquisition, or from an established supplier updating their bank details before a deadline, staff feel pressured to comply immediately. The absence of suspicious file attachments often allows these deceptive messages to bypass basic spam filters.
Common Types of Business Email Compromise Schemes
Business email compromise manifests in several common patterns that finance personnel must recognize during daily operations. The first pattern is the bogus invoice scheme, where an attacker impersonates an actual supplier. The attacker notifies the finance team that the supplier has changed banking partners or moved clearing houses. They present updated routing details and ask that pending payments go to the new account. Because the invoice matches real projects and purchase orders, finance teams process the payment without realizing the funds are diverted.
A second common scheme is executive impersonation, commonly referred to as CEO fraud. An attacker creates a lookalike domain name or compromises an executive mailbox to send a direct request to a junior finance officer. The message insists on total secrecy and immediate payment for an urgent contract, emergency settlement, or confidential legal fee. The victim assumes they are following direct leadership instructions and circumvents normal review workflows to satisfy the executive request.
A third variation targets employee payroll or direct deposit information. The attacker contacts human resources or payroll staff posing as an existing worker. The message requests an immediate change to the bank account on file for upcoming salary disbursements. Attackers also use stolen credentials to initiate data theft, asking payroll teams to provide tax forms and personal identification numbers. To examine headers from suspicious inbound messages, teams can run them through a phishing header analyzer to spot mismatched originating domains.
Technical Controls to Stop Email Account Hijacking
Regularly audit mailbox forwarding rules, external delegates, and connected third-party applications granted read access to corporate inboxes to detect unauthorized changes.
Stopping business email compromise requires technical defenses that prevent account takeover and block spoofed communication. The primary line of defense is mandatory multi-factor authentication across all corporate email accounts. Guidance from the FTC small business guidance advises businesses to enforce multi-factor authentication using authenticator apps, smartcards, or physical hardware tokens rather than single-factor passwords. Organizations should immediately turn on MFA for your most important accounts to block automated credential attacks.
Administrators must also restrict mailbox forwarding and inbox rules inside cloud productivity platforms. When attackers gain initial access, their first administrative action is often creating auto-forwarding rules that send incoming vendor emails to external addresses. They also configure deletion rules that automatically hide messages containing keywords like invoice, payment, or wire. Blocking automatic external forwarding at the tenant level ensures that compromised credentials do not turn into silent wiretapping operations.
Implementing domain protection protocols stops external attackers from spoofing your corporate identity. Configure Sender Policy Framework to define which mail servers can send messages on your behalf. Pair this with DomainKeys Identified Mail to cryptographically sign outbound emails, and deploy Domain-based Message Authentication, Reporting, and Conformance to enforce rejection policies when inbound messages fail authentication. These protocols prevent external actors from sending fraudulent emails that display your exact company domain in the header.
Operational Verification Rules for Finance Teams
Technical controls alone cannot prevent every fraudulent request, particularly when a legitimate supplier mailbox is compromised outside your network. Operational controls establish human checks that catch fraudulent wire instructions before money leaves company custody. Finance departments must institute an out-of-band verification procedure for any request that alters payee details, bank account numbers, or wire routing codes. An out-of-band check means using a separate, trusted communication method rather than replying to the original email thread.
Dual authorization is the second vital operational safeguard. The financial management platform should require two distinct users to release any outgoing payment that exceeds a defined monetary threshold. Under this model, an accounts payable specialist enters the payment information, while a financial controller or business owner independently reviews the physical documentation and releases the funds. This separation of duties prevents single points of failure, whether caused by an honest human mistake or an individual falling victim to an impersonation lure.
The NCSC small business guidance emphasizes that organizations must foster an environment where employees feel empowered to pause transactions and confirm anomalies. Attackers rely on emotional pressure to force hasty compliance. If an employee is penalized for slowing down a wire transfer to verify banking details with an executive, they will eventually process a fraudulent transfer to avoid conflict. Business leadership must explicitly reward caution whenever unusual payment instructions surface.
Building a Formal Payment Verification Policy
Every organization handling outbound payments needs documented procedures that govern account modifications and wire approvals. Informal agreements and verbal understandings fail when teams face urgent deadlines or high email volumes. Writing these requirements into essential small business security policies gives finance personnel the administrative authority to halt suspicious transactions without fear of executive backlash.
Your policy must specify exact steps for verifying account changes, define organizational thresholds for dual authorization, and mandate secure records storage. Many organizations customize approval tiers to fit their specific risk profile and operational size. The following framework serves as an illustrative baseline that teams can adapt for accounts payable procedures:
1. SCOPE: Applies to all employees, contractors, and officers processing outgoing payments.
2. OUT-OF-BAND VERIFICATION:
- Any request to add or modify vendor bank account numbers, wire instructions, or payment addresses requires voice verification before saving changes.
- Verification must occur via a phone number on file in the vendor master record, never from the email or invoice.
- A written log of the call (date, time, verified contact name, phone number) must attach to the vendor record.
3. DUAL AUTHORIZATION THRESHOLDS (ADJUST TO FIT YOUR RISK PROFILE):
- Payments below internal threshold: Single approval by designated department head.
- Payments exceeding internal threshold: Dual authorization required (Creator + Approver).
- Payments exceeding executive escalation threshold: Dual authorization plus verbal approval from senior leadership.
4. PROHIBITIONS:
- Urgent or confidential requests delivered solely via email cannot bypass standard authorization steps under any circumstances.Frequently Asked Questions
What is the primary difference between business email compromise and standard phishing?+
Standard phishing usually casts a wide net with generic lures that attempt to trick users into downloading malware or entering login credentials. Business email compromise is highly targeted social engineering that focuses specifically on redirecting financial transfers or stealing sensitive data, often using legitimate compromised accounts and lookalike domains without any attached malware.
Can email security filters completely eliminate the threat of business email compromise?+
No. While email filters block known malicious links and mismatched sender domains, business email compromise messages often originate from legitimate, compromised corporate accounts. Because these emails contain normal text and real invoice discussions without malicious code, operational controls like out-of-band verification and dual approvals remain necessary.
What is out-of-band verification and why is it essential for finance teams?+
Out-of-band verification requires confirming payment requests or account changes through a secondary communication channel that differs from the channel delivering the request. If an invoice update arrives by email, the employee calls a known, verified phone number on file to confirm the instructions directly before updating bank records.
How quickly must a business act to recall a fraudulent wire transfer?+
Businesses must contact their financial institution immediately upon discovering the incident. Wire transfers move through clearing networks rapidly, and once funds reach the receiving account, attackers quickly disperse them across multiple accounts. Reaching out to your commercial bank as soon as possible offers the best opportunity to initiate a recall or place a stop-payment request before settlement.